Vulnerability · Published Jul 12, 2023 · Assigned by 3DS
CVE-2023-2763Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023
High 7.8
In plain English
A high-severity use-after-free in SOLIDWORKS Desktop from Dassault Systèmes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dassault Systèmes | SOLIDWORKS Desktop | Release SOLIDWORKS 2021 Golden – through Release SOLIDWORKS 2021 SP5.1Release SOLIDWORKS 2022 Golden – through Release SOLIDWORKS 2022 SP5Release SOLIDWORKS 2023 Golden – through Release SOLIDWORKS 2023 SP2 |
Weakness: CWE-416, CWE-787, CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H